PCDE Practice Test 40 — 15 Questions

Question 1

What is the primary purpose of a blameless postmortem in incident management?

Accepted Answer

Document the timeline and technical root cause. Blameless postmortems focus on understanding contributing factors and improving systems, not assigning fault.

Answer

Identify the individual who caused the incident

Answer

Update the SLA to exclude the incident period

Answer

Assign monetary penalties to the responsible team

Question 2

An SRE team is setting up an on-call rotation for incident response. They want to use a tool that integrates with Cloud Monitoring and can escalate incidents if not acknowledged. Which service should they integrate with Cloud Monitoring?

Accepted Answer

PagerDuty. Cloud Monitoring can send notifications to PagerDuty, OpsGenie, and other incident management tools. PagerDuty is a common choice for on-call rotations and escalation policies.

Answer

Cloud Pub/Sub

Answer

Cloud Functions

Answer

Cloud Run

Question 3

A site reliability engineer is leading a blameless postmortem for an incident. Which THREE practices should be included? (Choose 3.)

Accepted Answer

List contributing factors. Blameless postmortems focus on understanding contributing factors and creating action items. The five whys technique helps find root cause. Action items should have owners and due dates. Assigning blame is explicitly avoided. Incident commander is part of incident management, not postmortem. A timeline is important.

Answer

Determine the incident commander for future incidents

Answer

Identify the person who caused the incident

Question 4

An organization uses Terraform to manage infrastructure across multiple teams. They want to implement a branching strategy that supports rapid iteration and continuous integration for infrastructure changes while ensuring that the main branch always reflects the desired state. Which Git branching model is most aligned with GitOps principles for IaC?

Accepted Answer

Trunk-based development with short-lived feature branches and automated CI/CD pipelines that apply changes upon merge to main.. Trunk-based development with short-lived feature branches is recommended for GitOps. Developers branch off main, make changes, commit frequently, and merge back to main after automated testing. This keeps main deployable and reduces merge conflicts.

Answer

Feature branching with long-lived branches for each environment (dev, staging, prod).

Answer

Each team maintains its own fork and periodically submits pull requests to a central repository.

Answer

GitFlow with separate branches for develop, release, and hotfixes.

Question 5

A DevOps engineer needs to create a custom IAM role that allows only the permission to create Compute Engine instances, but not to modify or delete them. What is the best practice for defining this role?

Accepted Answer

Create a custom role with permission `compute.instances.create`.. Custom roles are created with a list of permissions. To allow creation only, the role should include the `instances.create` permission. It should not include `instances.update`, `instances.delete`, or wildcards.

Answer

Use the predefined role `roles/compute.instanceAdmin.v1` and remove permissions.

Answer

Create a custom role with permission `compute.instances.*`.

Answer

Use the predefined role `roles/compute.instanceAdmin` and restrict it with conditions.

Question 6

An organization wants to enforce that all Compute Engine instances are created in a specific set of regions. Which Google Cloud feature should be used?

Accepted Answer

Organization policies. Organization policies allow you to set constraints on resources, such as the allowed locations for resource creation. The constraint `gcp.resourceLocations` restricts the regions where resources can be created.

Answer

VPC Service Controls

Answer

IAM conditions

Answer

Firewall rules

Question 7

A DevOps team is bootstrapping a new Google Cloud organization. They want to enforce that all Compute Engine instances must use Shielded VM features (Secure Boot, vTPM, Integrity Monitoring). Which organization policy should they set at the organization level?

Accepted Answer

Set the 'constraints/compute.requireShieldedVm' policy to true.. The 'constraints/compute.requireShieldedVm' policy enforces that all new VMs must have Shielded VM enabled. Policies are set at the organization, folder, or project level using the Org Policy Service.

Answer

Set the 'constraints/compute.disableSerialPortAccess' policy to true.

Answer

Set the 'constraints/compute.requireOsLogin' policy to true.

Answer

Set the 'iam.allowedPolicyMemberDomains' policy to restrict membership.

Question 8

A DevOps engineer is setting up CI/CD for a microservice application. They want to use Cloud Build to deploy to Google Kubernetes Engine (GKE) only if the build passes tests. Which Cloud Build configuration approach should they use?

Accepted Answer

Create a cloudbuild.yaml with a test step that fails the build if tests fail, and a subsequent deploy step that runs only if all previous steps succeed.. Cloud Build triggers can be configured to run a build config (cloudbuild.yaml) that includes steps for testing and deployment. Conditional deployment can be handled by the build steps themselves.

Answer

Use two separate Cloud Build triggers: one for testing and one for deployment, and manually trigger the deployment after tests pass.

Answer

Configure a single Cloud Build trigger that runs test and deploy steps in parallel.

Answer

Use Cloud Functions to orchestrate testing and deployment via separate Cloud Build API calls.

Question 9

A service has an SLO of 99.9% availability over a 30-day window. The team wants to automate a deployment rollback if the error budget burn rate exceeds 10x over a 30-minute window. Which combination of Cloud Monitoring and Cloud Build should be used?

Accepted Answer

Create a custom burn rate alert in Cloud Monitoring that sends a notification to a Cloud Function via HTTP, which then triggers Cloud Build to rollback. Cloud Monitoring can evaluate alert conditions and send notifications. Cloud Build can be triggered via webhooks or Pub/Sub. The correct approach is to create an alert policy with a custom condition for burn rate > 10x over 30 minutes, and configure the notification to invoke a Cloud Function or Cloud Run service that triggers a rollback using Cloud Build or Deployment Manager. Alternatively, Cloud Monitoring can directly use a webhook to call a Cloud Function. The simplest is to use a Cloud Function as the notification channel.

Answer

Create a Cloud Scheduler job that checks Cloud Monitoring metrics every 30 minutes and triggers rollback if needed

Answer

Configure Cloud Build to poll Cloud Monitoring metrics and trigger rollback when burn rate exceeds threshold

Answer

Use Cloud Monitoring's built-in rollback action in alert policies

Question 10

A service has an SLO of 99.9% availability over 30 days. In the first 10 days, the service has already consumed 60% of the error budget. Which action best aligns with SRE principles?

Accepted Answer

Declare a change freeze and focus on improving reliability. With high error budget consumption early, the team should throttle new releases to avoid exhausting the budget. This is a typical SRE practice: if error budget is nearly depleted, slow down changes.

Answer

Ignore the budget and continue deploying as usual

Answer

Extend the SLO window to 60 days to dilute the budget

Answer

Increase the SLO to 99.99% to tighten reliability

Question 11

An organization wants to implement privileged access management (PAM) for their Google Cloud environment. They need to grant temporary, just-in-time access to production projects for incident responders. Which GCP service should they use?

Accepted Answer

Use Cloud IAM Conditions to grant roles with a time constraint (e.g., request.time < timestamp).. Cloud IAM Conditions with Access Context Manager can be used to enforce time-based conditions on IAM roles. Additionally, using Cloud IAM's 'iam.roles.update' with time-based conditions or using the Cloud Asset Inventory for access approval are not standard. The best approach is to use Cloud IAM Conditions to grant roles that expire after a defined duration, combined with Access Approval for review.

Answer

Create custom roles that are only granted during incident response drills.

Answer

Use Cloud Audit Logs to monitor and revoke access after the incident.

Answer

Use VPC Service Controls to allow access only from specific IPs.

Question 12

An SRE team is defining SLIs for a data pipeline that ingests events from a pub/sub topic and writes to BigQuery. Which two metrics are good SLIs for pipeline freshness? (Choose TWO.)

Accepted Answer

Age of the oldest unprocessed message in the subscription. Pipeline freshness measures how up-to-date the data is. Latency of most recent event from ingestion to table and age of oldest unprocessed message are direct measures.

Answer

CPU utilization of Dataflow workers

Answer

Number of events published per second

Answer

Total number of rows in BigQuery

Question 13

An organization uses Terraform to manage infrastructure across multiple projects. They want to use a single shared Terraform state file for their production environment but isolate state for development environments. The team uses Terraform Cloud workspaces. Which state management approach is most appropriate?

Accepted Answer

Create separate Terraform Cloud workspaces for production and development environments.. Terraform Cloud workspaces provide isolated state per workspace. Using separate workspaces for production and development keeps state isolated while leveraging a single Terraform Cloud organization.

Answer

Use Terraform Enterprise instead of Terraform Cloud because it supports state isolation.

Answer

Use a single GCS bucket as the backend and store all states in the same prefix.

Answer

Use a single Terraform workspace for all environments, with separate state files via the -state flag.

Question 14

A site reliability team wants to define an SLO for a service with a target availability of 99.9% over a 30-day window. The error budget is exhausted. Which action MUST the team take?

Accepted Answer

Freeze all non-critical releases until the budget recovers.. When the error budget is exhausted, the SRE practice is to stop all non-critical releases and focus on improving reliability, as defined by the error budget policy. This aligns with SRE principles of using the budget to balance velocity and stability.

Answer

Ignore the budget and continue normal development.

Answer

Deploy a new feature to attract more users.

Answer

Increase the SLO to 99.95% to make up for lost budget.

Question 15

After a major incident, the SRE team conducts a postmortem. Which practice is ESSENTIAL for a blameless culture?

Accepted Answer

Focus on systemic failures and contributing factors.. Blameless postmortems focus on systemic causes and contributing factors, not individual mistakes. This encourages honest reporting and learning.

Answer

Assign action items with owners and due dates.

Answer

Skip the postmortem if the incident was minor.

Answer

Identify the person who caused the incident.